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Over  the  past  decades,  research  in  securi¬ 
ty  has  concentrated  on  the  development 
of  algorithms  and  protocols  for  encryption,  authenti¬ 
cation,  and  integrity  of  textual  data  or  data  with  simi¬ 
lar  characteristics.  Despite  tremendous  advances  in 
security-specifically,  the  development  of  asymmetric 
cryptographic  protocols  and  the  inception  of  strong 
symmetric  ciphers-plenty  of  security  problems  still 
afflict  systems.  For  example,  hackers  exploiting  weak¬ 
nesses  in  other  systems  and  the  use  of  inadequate  (too 
short)  cipher  keys  produce  frequent  news  headlines 
about  broken  security  systems. 

Despite  the  news  headlines,  such  problems  have  been 
well  explored  and  even  solved  in  principle,  therefore 
they  aren’t  the  primary  focus  of  this  special  theme  issue. 
Rather,  the  articles  here  cover  the  unsolved  problems 
in  image  security,  which  relate  fairly  closely  to  comput¬ 
er  graphics.  The  unsolved  challenges  arise  from  the 
increased  availability  and  distribution  of  multimedia 
content  over  Internet  services  such  as  the  World  Wide 
Web  and  their  implications  for  intellectual  property  pro¬ 
tection  and  copyright  issues. 

A  growing  number  of  scientific  groups  in  computer 
science  and  cryptography  have  confronted  these  chal¬ 
lenges.  Researchers  are  currently  working  on  issues  such 
as  visual  cryptography,  mechanisms  for  the  integrity  of 
image  material,  digital  signatures  for  multimedia  data, 
and  data  hiding  techniques.  Data  hiding,  which  has 
achieved  the  highest  popularity,  contemplates  the  cru¬ 
cial  needs  for  protecting  intellectual  property  rights  on 
multimedia  content  like  images,  video,  audio,  and  oth¬ 
ers.  These  needs  demand  robust  solutions  due  to  the 
explosion  of  publicly  available  multimedia  information 
and  the  easiness  with  which  this  information  can  be  dis¬ 
tributed,  copied,  and  modified.  Watermarking  technol¬ 
ogy  meets  these  demands  and  provides  a  feasible 
approach  to  protect  against-and  prove-illegal  copy¬ 
ing  and  redistribution  in  the  digital  world. 

This  special  theme  issue  presents  four  articles  that 
discuss  watermarking  solutions  for  dedicated  media 


types  such  as  images,  video,  and  geometric  models. 
They  range  from  an  overview  of  fundamental  water¬ 
marking  concepts  to  the  latest  research  results. 

In  “A  Watermarking  Framework  for  Copyright  Pro¬ 
tection  of  Digital  images,”  George  Voyatzis  and  Ioannia 
Pitas  review  fundamental  watermarking  concepts  and 
develop  a  generic  model  for  protecting  the  copyrights 
of  digital  products  including  a  trusted  registration 
authority. 

“Digital  Watermarking:  From  Concepts  to  Real-Time 
Video  Applications”  by  Christoph  Busch,  Wolfgang 
Funk,  and  Stephen  Wolthusen  focuses  on  the  specific 
demands  and  real-time  requirements  for  video  protec¬ 
tion.  Their  solution,  which  is  robust  against  strong 
MPEG-2  compression,  is  very  important  to  the  broad¬ 
casting  and  video  stock  industries. 

Boon-Lock  Yeo  and  Minerva  Yeung  address  a  new 
area  of  watermarking  via  3D  polygonal  models  with 
“Watermarking  of  3D  Objects  for  Verification.”  Then- 
article  takes  an  essential  step  into  this  untouched  area. 
They  provide  mechanisms  for  embedding  watermarks 
into  geometric  models  as  well  as  detection  mechanisms 
for  unauthorized  modifications. 

“Geometry-Based  Watermarking  of  3D  Models”  by 
Oliver  Benedens  presents  fundamental  progress  in  the 
same  field.  His  contribution  formulates  a  new  definition 
for  robustness  of  watermarks  in  correlation  to  3D  mod¬ 
els,  proposes  a  watermarking  mechanism,  and  evalu¬ 
ates  its  robustness  against  a  polygon  simplification. 

Finally,  we  would  like  to  mention  that  we  could  not 
consider  all  the  outstanding  submissions  received  for 
this  theme  issue  because  of  page  limitations.  Contribu¬ 
tions  were  reviewed  by  up  to  six  security  experts  from  all 
over  the  world.  We  would  like  to  thank  all  the  review¬ 
ers,  who  provided  constructive  comments  and  strongly 
influenced  the  selection.  Their  choices  allow  us  to  pro¬ 
vide  a  high-quality  overview  of  the  state-of-the-art  in 
the  field  and  describe  exciting  new  developments  and 
technologies.  We  hope  you  will  enjoy  reading  the  fol¬ 
lowing  pages.  ’  ■ 
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Protecting  Digital- 
Image  Copyrights: 
A  Framework 


In  the  past  decade,  the  scientific  community 
has  engaged  in  an  intensive  discussion  of 
security  issues  for  digital  data.  Piracy  of  such  data  has 
obstructed  the  rapid  evolution  of  digital  networks,  dig¬ 
ital  libraries,  and  World  Wide  Web  services.  The  con¬ 
venient  broadcasting  or  exposition  of  digital  products 
on  the  global  network  leads  easily  to  illegal  copying  and 
retransmission.  The  same  happens  with  data  transmit¬ 
ted  through  insecure  channels. 

Today,  digital  data  security  covers  such  topics  as 
access  control,  authentication,  and  copyright  protection 
for  still  images,  audio,  video,  and  multimedia  products.’ 
The  networking  environment  of  the  future  will  require 
tools  that  provide 


■  secure  and  fast  digital  data  encryption  and  decryp¬ 
tion, 

■  content  verification  (authentication)  of  the  received 
data  by  the  recipient,  and 

■  robust  and  trustworthy  marks  indicating  copyright 
and  legal  ownership. 


Digital  watermarks  offer  a 
way  to  counter  copyright 
piracy  on  the  global 
network.  We  summarize  the 
fundamental  concepts  of 
watermarking  and  describe 
a  general  framework  for  a 
copyright  protection  system. 


For  the  first  of  these  items,  pri¬ 
vate-  and  public-key  cryptography 
are  widely  used  and  have  well- 
established  algorithms.  (These 
include  RSA,  the  Rivest-Shamir- 
Adleman  algorithm,  and  DES,  the 
Data  Encryption  Standard?)  For 
authentication,  one  proposal  is  dig¬ 
ital  signatures,  which  are  also  based 
on  cryptographic  algorithms?  In 
this  article,  we  address  the  third 
item.  We  describe  how  digital  water¬ 
marking  can  contribute  significant¬ 
ly  to  a  realistic  framework  for 
protecting  intellectual  property 
rights  in  digital  media. 


What  is  a  digital  watermark? 

The  concept  of  the  digital  watermark  is  a  new  topic4,5 
associated  with  the  data-hiding  technique  known  as 
steganography?  Steganography,  or  “covered  writing,” 


George  Voyatzis  and  Ioannis  Pitas 
U  niversity  ofThessaloniki 

has  a  long  history  that  includes  various  methods  of  secret 
communication.  In  contrast  to  cryptography,  steganog¬ 
raphy  does  not  immediately  arouse  suspicion  of  some¬ 
thing  secret  or  valuable.  Instead,  it  hides  an  important 
message  within  an  unimportant  one.  Watermarking — 
also  called  tamper-proofing  or  content  verification7 —  ' 
hides  a  secret  and  personal  message  to  protect  a 
product’s  copyright  or  to  demonstrate  its  data  integrity. 

An  important  difference  between  steganography  in 
general  and  watermarking  relates  to  the  attacker’s  goal. 

A  pirate  tries  to  reveal  the  information  a  steganography 
message  carries.  However,  a  pirate  tries  either  to  remove 
a  watermark  to  violate  a  copyright  or  to  cast  the  same 
watermark,  after  altering  the  data,  to  forge  proof  of 
authenticity. 

Generally,  the  watermarking  of  still  images,  video, 
and  audio  demonstrate  certain  common  fundamental 
concepts.  Without  significant  loss  of  generality,  we  will 
focus  on  watermarking  still  images  with  a  sufficient 
number  of  grayscale  levels  or  colors  (8-bit  grayscale  or 
24-bit  color  images).  Using  such  images  as  examples, 
we  discuss  the  efficiency  of  watermarks  for  copyright 
protection. 

Digital  image  protection  via 
watermarking 

To  understand  the  role  of  watermarks  in  an  intellec¬ 
tual  property  (IP)  protection  framework,  consider  the 
elementary  digital  media  delivery  system  presented  in 
Figure  1 .  The  user  gets  a  digital  product  from  a 
provider-the  copyright  owner  or  an  authorized  dis¬ 
tributor.  Access  and  transmission  take  place  in  a  global  , 
network  environment.  Users  who  do  not  retransmit  the 
products  do  not  violate  the  copyright  property.  Pirates 
harm  the  copyright  owner  by  reproducing  and  retrans¬ 
mitting  digital  products  illegally.  That  is,  pirates  func¬ 
tion  as  unauthorized  providers. 

A  protection  scheme  should  give  providers  a  reliable 
method  for  efficiently  searching  the  network  for  copies 
that  originally  belonged  to  them.  Such  a  scheme  should 
also  supply  strong  indications  for  asserting  legal 
ownership. 

A  digital  watermark  (called  also  a  copyright  label  or 


invisible  stamp)  is  associated  with  a 
unique  private  identification  num¬ 
ber  called  a  watermark  key.  Under  a 
watermarking-based  protection 
scheme,  each  provider  possesses  a 
unique  secret  key/Cpr  (or  a  finite  set 
of  keys).  The  scheme  itself  consists 
of  the  following  actions:1,7 


1  Basic  system 
for  digital 
image  distribu¬ 
tion. 


■  The  copyright  owner  alters  the  digital  data  of  the  orig¬ 
inal  image  I0  to  produce  the  watermarked  image  Iw  by 
using  the  private  key  and  a  public  or  private  algorithm 

E:Iw  =  E  (/o.Kpr). 

■  The  copyright  owner  can  detect  the  watermark  by 
using  an  algorithm  D: 


Basic  watermarking  procedures 

The  literature  contains  various  definitions  of  digital 
watermarks.8-10  For  digital  images  of  size  Nx  M,  it  is  con¬ 
venient  and  quite  general  to  consider  2D  watermark  sig¬ 
nals  that  consist  of  binary  or,  more  generally,  ternary 
elements: 


DU,K)  = 


1  if/  ~  lw  and/C  =  Kpr 

0  otherwise 


Cl) 


The  relation  A  ~  B  denotes  perceptual  similarity  between 
images  A  and  B.  I0  ~  Iw  because  watermarking  should 
produce  almost  invisible  alterations. 

To  complete  the  watermarking  scheme,  we  include 
the  following  actions,  which  are  optional  on  the  part  of 
the  provider: 


■  The  provider  possesses  a  personal  archive  I  of  origi¬ 
nal  digital  images  and  a  matching  procedure  m  such 
that 


m(J,  L) 


fl  if  /  €  L  and  l~l 

[0  otherwise 


(2) 


w  =  (w(k):  |  w(k)  e  {-1,  0,  1},  k  €  W} 

or  white  noise  in  [-1, 1] .  W  denotes  a  2D  grid  of  size 
N  x  M.  Vector  k  indicates  the  grid  positions  of  the  water¬ 
mark  pixels. 

The  three  fundamental  stages  of  watermarking  are 
generation,  embedding,  and  detection.  Figure  2  shows 
a  schematic  presentation  of  the  overall  algorithm. 

Watermark  generation 

Let  W  be  the  set  of  possible  watermark  signals-that 
is,  all  the  signals  having  elements  in  (-1,  0, 1>.  We  con¬ 
sider  the  finite  and  countable  space  K  of  keys.  If  X 
denotes  the  set  of  digital  images,  we  define  a  watermark 
generation  procedure  by  the  noninvertible  function 


■  The  provider  registers  watermark  key  Kpr  to  a  trusted 
authority  and  ensures  its  uniqueness. 

■  The  provider  registers  watermarked  images  I  e  L  with 
a  trusted  authority  to  establish  (time-stamp)  owner¬ 
ship  of  1. 

The  aim  of  this  copyright  protection  systemis  to  enable 
providers  to  check  possible  violation  of  their  copyright 
property  by  monitoring  the  traffic  and  exposition  of  dig¬ 
ital  images  in  the  distribution  network.  Positive  detec¬ 
tion  of  the  provider's  watermark  (D(I,  Kpr)  =  1)  is  an 
indication  of  ownership  that  the  provider  can  use  as  sub¬ 
stantiated  evidence  in  a  court  of  law.  The  registration  of 
the  originals  to  a  trusted  authority  can  give  full  proof  of 
ownership  in  case  of  detection  ambiguities-for  exam¬ 
ple,  if  there  has  been  an  attack  on  the  watermark. 


G:XxK->Vi  ,W=  GQ,K) 

where  K  e  K  is  the  watermark  key,  and  I  e  X  is  the  image 
in  which  the  watermark  will  be  embedded.  Without  loss 
of  generality,  we  decompose  G  as  follows: 

G  =  ToR,R:K-4W,T:WxXxK-»W 

R  should  be  noninvertible”  and  may  be  based  on  a 
pseudorandom-number  generator  or,  generally,  on 
chaotic  systems.  When  we  insert  key  1C  in  R,  we  create  a 
fixed  watermark  Wq  =  R(K).  T  modifies  Wo  to  obtain  the 
final  watermark  1/1/  that  depends  on  the  particular 
image.  The  watermark  modification  function  T  should 
take  into  account  only  robust  characteristics  of  the 
image  data.  The  original  image  I0,  the  watermarked  one 
Iw,  and  a  modified  copy  of  Iw  (denoted  /'«,)  must  result 


Algorithm 


2  Overall  watermarking  algorithm,  including  embed¬ 
ding  and  detection,  both  of  which  require  watermark 
generation  first.  The  copyright  label  is  a  binary  stream 
that  carries  public  information  about  ownership. 


3  The  distributions  of  the  detector 
output  for  the  null  hypothesis 
(watermark  does  not  exist)  and  the 
alternative  hypothesis  (watermark 
exists)  for  statistical  detection  , 
based  on  the  t  test.  Certainty 
(c  =  1  -  />»,)  depends  on  the  selec¬ 
tion  of  the  t  threshold  t*. 


procedure  directly  to  the  intensity 
or  luminance  domain,  we  can  apply 
it  to  the  discrete  cosine  transform 
(DCT)  domain8-9  or  the  wavelet 
domain.12 

Watermark  detection 

Watermark  detection  is  the  most 
crucial  part  of  a  watermarking 
framework.  By  adopting  a  hypothe¬ 
sis-testing  framework,  in  practice 
we  obtain  detection  errors  and  devi¬ 
ate  from  the  ideal  detection  (Equa¬ 
tion  1).  Such  errors  fall  into  two 
categories: 


4  A  chaotic 
binary  water¬ 
mark  for 
embedding  in  a 
digital  image. 


■  Type  1  errors.  We  detect  the  watermark,  but  it  does 
not  actually  exist  in  the  data.  Such  false  positives  con¬ 
tribute  to  the  probability  of  false  alarm  (P/a) . 

■  Type  II  errors.  We  do  not  detect  the  watermark  in  the 
data,  but  it  does  exist.  Thus,  we  get  false  negatives 
that  contribute  to  the  probability  of  false  rejection 
(Prej).  ot 

Taking  these  error  probabilities  into  account,  we 
define  a  detection  procedure  as  follows: 

D :  X  x  K  (0,  l)cR 

D(I,W)=D(I,G(I,Kpr))=c 

The  output  c  denotes  the  certainty  of  a  positive  detec¬ 
tion.  The  final  decision  is  based  on 

c  >  c,hres  =r>  watermark  exists 


adequately  in  the  same  watermark  when  perceptual 
similarity  is  satisfied: 

w  =  T(Wb,  h)  =  UW0,Iw)  =T(Wo,Iw) 
forany/o~/w~/w 

Watermark  embedding 

We  define  the  embedding  procedure  as  a  superposi¬ 
tion  of  the  digital  watermark  signal  W  =  (w(k))  onto 
the  original  image  I0  =  {x0(k)}  of  the  same  dimension. 
We  denote  the  embedding  procedure  by  E,  which  we 
define  as 

E :  X  x  W  x  1R2  ^  X ,  x„(k)  =  x0(k)  ®  H(k)  ®  wfk)  (3) 

H  (k)  is  a  2D  watermark  embedding  mask  that  controls 
watermark  visibility  and  robustness.  ®  is  a  superposi¬ 
tion  operator  including  appropriate  truncations  and 
quantization,  and  ®  is  a  generalized  multiplication 
operator.  The  expression  Iw  =  -Ow(k)}  denotes  the 
watermarked  image.  The  recovery  of  the  original  from 
the  watermarked  image  is  desirable  but  not  necessary, 
because  the  copyright  owner  can  store  the  original  in 
a  private  archive.  Instead  of  applying  this  embedding 


Generally,  c  =  /(t),  where  t  is  a  test  statistic.  The  para¬ 
meter  coins  is  the  certainty  level  for  detection,  chosen  by 
the  image  provider  who  applies  detection.  It  is  associ¬ 
ated  with  a  test  value  r  that  controls  (balances)  the  two 
error  types.  Figure  3  illustrates  this  situation.  When  c  is 
close  to  unity,  false  negatives  become  insignificant 
( P/a  ->  0).  However,  at  the  same  time,  Pnj  increases  and, 
consequently,  the  detector’s  overall  performance 
declines.  D  approaches  the  ideal  detector  D  (see  Equa¬ 
tion  1)  when  both  Pfa  and  P„j  tend  to  zero. 

This  detection  scheme  performs  a  binary  decision 
with  a  given  certainty  level  and  answers  the  funda¬ 
mental  question,  “Does  watermark  WQ,  Kpr)  exist  in 
product  I?”  In  the  framework  we  propose,  only  the  legal 
owner,  who  possesses  key  Kpr,  can  perform  detection. 
Therefore,  in  principle,  it  is  redundant  to  hide  multib¬ 
it  information  identifying  the  owner  in  the  water¬ 
marked  product.  However,  bitstream  information 
hiding  and  retrieval  (possibly  error-corrected13)  can 
increase  certainty  in  the  detection  process  or  give  illus¬ 
trative  indications  of  ownership  (such  as  a  company 
logo)  or  store  product  manipulation  operations.  It 
would  also  be  useful  to  embed  ownership  information 
for  other  reasons-for  example,  if  a  trusted  authority 
watermarks  the  products  of  various  owners  with  the 
same  key. 


A  watermarking  example 

Several  already  proposed  water¬ 
marking  schemes  would  work  with 
the  general  framework  we  describe; 
we  have  presented  such  a  scheme 
previously. 14  For  the  purposes  of 
illustration,  we  summarize  a  simple 
version  of  the  method  and  apply  it 
to  an  image. 


5  Embedding  a  digital  watermark, 
(a)  The  original  image,  “Lenna.”  (b) 
Invisible  watermarking  of  “Lenna” 
using  h  =  2  on  the  left  section  and  h 
=  8  on  the  right  section.  The  water¬ 
marking  on  the  right  section 
degrades  the  image. 


Step  A.  The  bivalued  watermark 
Wo  =  {vv(ij)},  presented  in  Figure  4 
as  a  black-and-white  image,  is  creat¬ 
ed  by  watermark  generation  proce¬ 
dure  G  using  a  chaotic  system.  The 
set  of  integer  numbers  is  the  water¬ 
marking  key  set.  Each  integer  corre¬ 
sponds  to  a  set  of  parameters  for  the 
chaotic  system  through  a  well- 
defined  function.  Therefore,  each 
key  represents  a  unique  initial  con¬ 
dition  of  the  chaotic  sequence  and 
can  create  a  sufficiently  different 
watermark  for  each  different  key. 

Using  chaotic  systems,  we  can 
efficiently  control  the  watermark’s 
low-pass  characteristics  to  achieve 
sufficient  robustness  under  lossy 
compression  or  low-pass  filtering. 


6  Watermark  detector  output  for 
various  incorrect  keys  (red  peaks) 
and  correct  keys  (blue  peaks).  With 
the  correct  keys,  the  system  easily 
distinguishes  the  watermark  in  the 
original  watermarked  Image  and 
high-quality  compressed  versions 
of  it. 


Step  B.  Let  I0  =  { x(i,j )}  denote  the  8-bit  luminance 
space  of  the  original  image  (Figure  5a)  to  be  water¬ 
marked.  As  we  discussed  earlier,  we  apply  operator  T  to 
Wo  to  obtain  an  image-dependent  watermark  I/I/.  Tmust 
preserve  Ws  main  features-in  our  example,  its  low- 
pass  character.  This  is  feasible  if  T  alternates  (or  doesn’t 
alternate)  the  watermarkvalues  by  taking  into  account 
robust  characteristics  of  the  image  regions  indicated, 
for  example,  by  vector  t  =  p  +  r(K).  Here,  p  denotes 
the  particular  watermark  pixel  examined,  and  r  is  a  key- 
dependent  vector.  A 

Step  C.  We  form  the  watermarked  image  Iw,  which  is 
the  same  size  as  the  original,  by  applying  equation  3  and 
using  a  constant-embedding  mask  (h$  =  h=  const).  The 
symbol  0  denotes  the  usual  addition  operator  and  the 
necessary  truncations. 

0  ifx(i,j)+hw(i,j)<0 

xxvfij)  ='255  ifx(i,j)  +  /nv(i,j)<255 

x(i,  j)  +  hw(i,  j)  otherwise 

The  constant  h  should  be  small  to  guarantee  the  invisi¬ 
bility  of  the  watermark  in  Iw.  For  h  =  2  the  result  is  the 
watermarked  image  presented  in  the  left  part  of  Figure 
5b.  When  we  use  /r  =  8,  as  in  the  right  part  of  Figure  5b, 
the  watermark  embedding  causes  clearly  visible 
degradations. 

Step  D.  We  can  apply  detection  to  any  image  I  of  the 
same  size.  We  generate  watermark  W  using  the  specific 
key  and  the  image  I.  The  image  pixels  are  divided  into  two 


subsets  A  =  {(f,  j)  |  wv  =  1}  and  B  =  {(i,j)  \  Wy  =  -1}, 
which  have  mean  luminance  valuesA  andB  .  We  consid¬ 
er  the  following  detection  response: 

R  =  D(I,  W)  =  A- B 

We  assume  that  x  and  w  are  statistically  independent 
random  variables.  Thus,  R  should  follow  the  normal 
distribution  N(  R,  o),  where  R=2h  when  1/1/  exists  in  I 
and  R= 0  otherwise.  When  a  watermarked  image  Iw  is 
modified  somehow  (for  example,  by  lossy  compression 
or  filtering),  we  expect  R  <  2h.  We  assume  the  water¬ 
mark  exists  when  R  >  Rthres.  The  constant  Rthres  is  a 
threshold  value  associated  with  a  certainty  level  cthns 
for  a  positive  detection.  After  numerical  experiments, 
we  found  that  for  Rthres  >0.1,  the  minimum  detection 
certainty  is  99.9  percent. 

Figure  6  shows  the  detection  response  R  obtained 
from  Iw  by  using  1,000  incorrect  watermark  keys.  The 
blue  peaks  of  R  come  from  Iw  or  versions  of  it  that  we 
JPEG-compressed  for  various  JPEG  (Joint  Photograph¬ 
ic  Experts  Group)  quality  factors.  We  used  the  correct 
key  for  each  of  these  peaks.  With  a  decreased  the 
system  can  detect  the  watermark  even  with  high  com¬ 
pression  ratios  (or,  generally,  major  modifications). 
However,  this  would  cause  false  alarms  as  well. 

Basic  watermarking  demands 

The  basic  watermarking  methods  we  have  present¬ 
ed  efficiently  protect  the  copyright  property  if  the  fol¬ 
lowing  features  characterize  the  elementary 
procedures  G,  E,  and  D, 


Perceptual  quality  preservation 

Embedding  a  watermark  in  a  digital  image,  video,  or 
audio  signal  should  not  reduce  its  perceived  quality.  An 
nvisible  watermark  satisfies  this  requirement.  There¬ 
fore,  we  should  take  human  visual  perception  into 
iccount  when  casting  watermarks.  In  the  embedding 
cheme  described  by  Equation  3,  the  proper  choice  of 
he  embedding  maskH(k)  guarantees  invisibility.  That 
s,|H(k)|  <  JND,  where  JND  denotes  just-noticeable 
listortion  of  the  image.  Some  watermarking  schemes 
lave  used  human  visual  models  that  provide  strong  but 
nvisible  image  alterations.15-16 
Generally,  however,  watermark  invisibility  implies 
jotential  watermark  removal  by  lossy  compression,  and, 
jossibly,  by  other  processing  operations.  Small  per- 
:eivable  alterations  that  cannot  be  considered  distor- 
ions  of  the  original,  or  that  do  not  reveal  artifacts  under 
Dostprocessing  operations  (if  necessary),  offer  a  possi- 
jle  alternative.  We  stress  that,  in  most  cases,  only  the 
watermarked  image  is  available  to  the  user. 

Trustworthy  detection 

We  can  evaluate  the  performance  of  a  watermark 
detection  procedure  D  by  using  the  total  error  probabil¬ 
ity  JUt  =  Pfa  +  P rtj-  The  contribution  of  the  errors  Pja  and 
Prej  to  form  the  total  detection  error  Perr  is  controlled  by 
certainty  level  cams-  We  distinguish  the  following  cases: 

■  Detection  with  low  certainty.  False  alarms  are  frequent. 
However,  the  probability  of  missing  the  detection  of 
a  watermarked  image  is  very  small.  Providers  can 
ascertain  the  reliability  of  a  positive  detection  by 
searching  their  archive  for  the  image  and  applying 
the  matching  process  m. 

■  Defection  with  high  certainty  In  this  case,  Pfa  -»  0,  and 
the  detector  provides  very  reliable  positive  detection. 
Watermark  detection  with  extremely  small  false- 
alarm  probability  may  stand  by  itself  as  sufficiently 
reliable  evidence  for  proving  legal  ownership  in  a 
court  of  law.  However,  the  rejection  probability  may 
become  quite  significant. 

The  capability  of  G  to  produce  an  enormous  water¬ 
mark  set  W  consisting  of  obviously  distinguishable  ele¬ 
ments  in  the  detection  procedure  is  a  necessary 
condition  for  achieving  very  low  false-alarm  probabili¬ 
ties.  Therefore,  rich  complexity  should  characterize 
watermark  signals  (for  example,  see  Figure  4). 

Computational  efficiency 

Watermark  casting  and  detection  are  two  separate 
algorithms.  They  should  be  easy  to  use,  applicable  to  any 
digital  image,  and  trustworthy.  .Although  the  provider 
embeds  watermarks  in  each  product  only  once,  detection 
should  apply  to  a  large  set  of  publicly  exposed  images. 
Therefore,  very  fast  watermark  detection  is  desirable.  The 
private  key  and  the  watermarked  image  should  suffice  to 
perform  watermark  detection.  Watermarks  can  be  com¬ 
bined  with  an  automated  search  procedure  that  search¬ 
es  for  illegal  copies  in  any  public  network  or  broadcasting 
environment  (web-crawling  or  monitoring). 

A  necessarv  condition  for  develoninn  such  a  svstem 


is  to  avoid  the  use  of  the  original  product  (or  any  infor¬ 
mation  associated  with  it)  in  the  detection  algorithm. 
Otherwise,  the  network  monitor  would  have  to  apply 
matching  procedure  m  (Equation  2)  between  all  net¬ 
work  images  examined  and  all  images  in  the  private 
archive.  This  would  result  in  unacceptable  computa¬ 
tional  complexity  and  make  watermarking  entirely  use¬ 
less.  In  our  approach,  watermarking  is  essentially  a 
copyright  signaling  mechanism. 

Robustness  to  digital  processing 

Watermark  robustness  under  image  modification  is 
an  essential  issue  for  copyright  protection.8,9  Any 
provider  or  user  can  modify  an  original  digital  image  to 
improve  quality,  compress  data,  edit  digitally,  and  so  on. 
Protecting  copyright  while  maintaining  sufficient  qual¬ 
ity  under  these  conditions  is  desirable.  Preservation  of 
image  quality  implies  preservation  of  perceptual  simi¬ 
larity.  Usually,  we  demand  watermarks  to  be  robust 
under  the  following  image-processing  operations: 

■  Lossy  compression.  It  is  the  most  widely  used  proce¬ 
dure  for  storing  and  transmitting  digital  still  images, 
video,  and'  audio.  The  widely  used  JPEG  and  MPEG 
(Moving  Pictures  Experts  Group)  algorithms  provide 
a  high  compression  ratio  and  the  desired  quality. 
However,  compression  algorithms  tend  to  remove 
invisible  information  that  can  be  related  to  the  water¬ 
mark.  Therefore,  watermarks  should  combine  invis¬ 
ibility  and  robustness  simultaneously. 

■  Filtering  and  enhancement.  Users  apply  filtering  to 
remove  noise  or  to  improve  the  perceptual  quality. 
This  process  can  remove  watermarks  as  well.  In  addi¬ 
tion,  attackers  may  develop  filters  specifically 
designed  for  watermark  removal.  Denoising  filters 
are  usually  low-pass;  thus,  watermarks  should  pos¬ 
sess  low-pass  characteristics. 

■  Geometric  modifications  In  the  case  of  digital  images 
such  modifications  include  scaling,  rotation,  cropping, 
reflection,  line  and  column  extraction  or  insertion,  and 
combinations  of  these.  Salient  image  features  or  the 
invariant  properties  of  the  Fourier  domain  have  been 
used  for  casting  robust  watermarks?  The  watermark 
should  cover  the  entire  image  so  that  it  will  be  robust 
to  cropping.  Watermark  detection  in  geometrically 
modified  products  without  resorting  to  the  original 
product  is  a  difficult  task.  Although  there  has  been 
considerable  progress  in  this  area  recently,  the  prob¬ 
lem  is  still  unsolved  in  its  general  form.” 

■  Different  image  presentations.  Auser  or  pirate  can  print 
a  watermarked  digital  image  and  then  create  a  new 
digital  copy  by  rescanning.  If  this  process  does  not 
reduce  the  image  quality  significantly,  the  watermark 
should  still  be  detectable  in  the  rescanned  image. 

■  Color  correction.  Usually,  watermarks  are  embedded 
in  the  luminance  component  so  that  they  are  resis¬ 
tant  to  compression.  Therefore,  they  are  resistant  to 
color  corrections. 

Intentional  attacks  on  watermarks 

The  watermarking  scheme  we  have  described  may  be 
attacked  directiv  or  indirectly  to  undermine  its  capaci- 


ty  to  indicate  legal  ownership. 18,19  The  following  sections 
discuss  possible  attacks  and  methods  of  defense  against 
them.  Remember,  our  scheme  does  not  allow  the  use  of 
originals  in  the  detection  procedure. 

Extraction  of  counterfeit  watermarks 

Pirates  know  the  principle  of  the  public  watermark¬ 
ing  detection  algorithm.  Thus,  they  may  form  a  signal 
W"  for  a  particular  image  I,  which  forces  the  detector  to 
indicate  that  the  image  is  watermarked?  In  other  words, 
W  is  a  watermark  signal  never  embedded  in  I,  but  the 
%  pirate  uses  it  as  his  or  her  own  watermark.  However,  W 
should  be  associated  with  a  keyK  e  K  through  the  water¬ 
mark  generation  procedure  G.  Because  this  procedure  is 
generally  not  invertible,  such  an  attack  is  extremely 
unlikely  to  succeed.  Procedure  R  usually  inherits  G’s  non- 
invertibility.  Qiao  and  Nahrstedt  describe  a  noninvert- 
ible  scheme  based  on  the  DES  cryptosystem.11 

Detection  of  false  positives 

A  pirate,  after  a  trial-and-error  procedure,  might  find 
a  key  K'  that  provides  a  positive  detector  response  and 
then  claim  that  K’  indicates  his  or  her  ownership.  How¬ 
ever,  the  pirate  can  find  such  a  key  only  after  approxi¬ 
mately  1/Pfa  applications  of  D,  where  Pp,  is  the  minimum 
acceptable  false-alarm’probability.  Watermark  detec¬ 
tion  with  relatively  significant  Pp,  becomes  quite  reliable 
when  providers  register  their  keys  with  a  trusted  author¬ 
ity.  In  such  a  case,  the  probability  that  the  counterfeit 
key  K ■  coincides  with  a  provider’s  registered  key  is 
extremely  small. 

Statistical  watermark  extraction 

A  great  number  of  digital  images,  all  watermarked 
with  the  same  key,  must  not  reveal  the  watermark  when 
the  pirate  applies  statistical  methods  such  as  averaging. 
Therefore,  watermarks  should  not  be  statistically  recov¬ 
erable.  An  efficient  protection  against  such  an  attack  is 
1  to  use  image-dependent  watermarks.20  We  have  antic¬ 
ipated  this  requirement  by  introducing  procedure  Tdur- 
ing  watermark  generation.  A' 

Multiple  watermarking 

Multiple  watermarking  can  be  useful  when  product 
resellers  want  to  embed  their  own  watermark  in  a  prod¬ 
uct.9,10  However,  an  attacker  may  use  this  property  to 
embed  his  or  her  own  watermark.  Both  the  original  and 
the  pirate’s  watermarks  can  be  detected  using  the  cor¬ 
responding  unique  key.  Generally  speaking,  we  can 
detect  the  watermark  embedded  at  a  later  stage  with 
greater  certainty.  However,  in  general,  we  cannot  defi¬ 
nitely  conclude  which  watermark  was  embedded  first. 
In  this  case,  the  image’s  original  owner  is  the  only  one 
who  can  produce  a  copy  containing  only  his  own  water¬ 
mark.  Subsequently,  the  original  owner  can  prove  legal 
ownership  in  cases  of  conflict.  This  eventuality  explains 
the  need  for  a  private  archive  and  watermarked  prod¬ 
uct  registration,  as  described  earlier. 

Watermarking  with  arbitrary  keys 

Malevolent  users  or  pirates  may  apply  watermarks  to 
any  accessible  image  by  using  arbitrary  keys-a  process 


known  as  “watermark  bombing.”  If  these  products  are 
publicly  exposed,  great  confusion  may  arise  during  the 
automated  watermark-searching  procedure.  The  nega¬ 
tive  consequences  of  such  an  indirect  attack  are  restrict¬ 
ed  by  the  fact  that  we  demand  an  enormous  set  of 
watermark  keys.  An  efficient  method  of  preventing  such 
an  attack  is  to  consider  distribution  restrictions  on 
provider  keys.  Each  watermarking  software  package 
should  supplyjust  one  or  a  few  keys  to  each  provider  for 
watermark  casting. 

Private  key  loss  or  theft 

The  loss  of  the  private  key  can  enable  a  pirate  to 
remove  the  watermarks  from  all  the  images  that  belong 
to  that  particular  owner.  This  would  make  the  system 
dangerously  unstable.  A  solution  to  this  serious  prob¬ 
lem  could  be  provided  by  a  combination  of  secure  time- 
stamping2  and  time-dependent  watermarks.  These 
actions  would  restrict  such  an  attack  to  a  small  number 
of  products.  This  solution  has  the  drawback  of  increased 
detection  complexity. 

Miscellaneous  modifications 

A  pirate  can  apply  a  sequence  of  various  uncommon 
image-processing  operations  to  confuse  the  monitoring 
software  or  to  desynchronize  the  detector.  (For  example, 
the  pirate  might  use  the  “mosaic  attack,”  which  is  essen¬ 
tially  a  cropping  attack.13)  Unfortunately,  once  the  data 
are  out  in  the  distribution  network,  there  is  always  the 
risk  of  watermark  removal  by  new  techniques.  In  this 
case,  the  sole  protection  is  the  registration  procedure. 

Product  registration 

The  use  of  Web  servers  or  trusted  third  parties  in  a 
copyright  protection  system  is  one  proposal  for  solving 
the  problems  that  exist  in  a  pure  watermarking  tech¬ 
nique11.  Product  registration  to  a  trusted  authority  is  a 
well-established  way  of  protecting  intellectual  property 
rights  of  various  products-for  example,  books,  software 
packages,  and  so  on.  Registration  information  can  offer 
indisputable  proof  of  original  ownership  and  legal  rights. 
A  protection  system  based  on  product  registration 
requires  the  following  actions  before  product  disposition: 

1.  The  provider  registers  with  a  trusted  authority, 
which  provides  a  watermarking  key  (or  set  of  keys) 
or,  generally,  a  private  watermark-embedding  soft¬ 
ware  package. 

2.  The  provider  uses  the  registered  key  or  the  private 
software  to  cast  watermarks. 

3.  The  provider  includes  the  original  product  in  an 
archive  and  registers  the  watermarked  product  with 
a  trusted  authority. 

4.  The  provider  conducts  an  automated  watermark 
search  on  the  distribution  network.  A  provider  whc 
uses  low-certainty  detection  reinforces  the  reliabil¬ 
ity  of  a  positive  detection  result  by  searching  the 
archive. 

5.  Producing  the  registered  copy  in  a  court  of  law  con 
stitutes  proof  of  copyright  ownership. 

As  this  scenario  shows,  the  inclusion  of  registratior 


chemes  in  the  protection  system  means  that  the  water-  Protocols  for  Protecting  Rightful  Ownership  and  Cus- 
nark  contribution  is  restricted  to  the  monitoring  and  tomer’s  Rights,”  to  be  published  in  J.  Image  Comm,  and 
liscovery  of  illegally  distributed  products.  The  water-  Image  Representation,  1998. 

narking  detector  should  provide  a  reliable  detection  12.  D.  Kundur  and  D.  Hatzinakos,  “A  Robust  Digital  Image 

lertainty  level,  recommending  that  the  provider  pro-  Watermarking  Method  Using  Wavelet-Based  Fusion,”  Proc 
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